About Cesar Adrian Garza Ruiz

Cesar Adrian Garza Ruiz · ‎05-19-2014

Hi, I have the same issue, I just install a new clean CUCM 9.1 and CUC 9.1 in UCS C220 with pre-installed esxi 5.1, I leave the clients site the last Friday and today say to me that the servers is down, just turn on the server and everything comes back, in the vmware logs the only error that show is "2014-05-18T15:31:00.802Z [3DAE2B90 error 'SoapAdapter.HTTPService'] HTTP Transaction failed on stream TCP(error:Transport endpoint is not connected) with error N7Vmacore15SystemExceptionE(Connection reset by peer)" but I saw that error in the log before I installed this site the last May 5, anyone have a clue of what I have to look. Of if this error could do a crash or reset in the system. Thanks in advance. Cesar

Cesar Adrian Garza Ruiz · ‎05-07-2014

Hi Everyone, I have the same issue, is a new clean installation with the upgrade of the dev. pack I can add all the phones but stills in register, with others phones is working fine 7965 phones and CIPC, any answer with thiss issue. Best regards. CG

Cesar Adrian Garza Ruiz · ‎11-13-2013

Hi everyone, i face an issue when I called a number in the pstn trough a at&t PRI trunk with a c2921 that is my gateway in a BE6000, in the settings of the phone the video capabilites is ENABLED, but the call innmediate fail, in the same branch also have a IP Phone 6921 that works without problem in a pstn calls, the workaround is to DISABLE the video capabilites, and the 8941s works great, and here is the cuestion, how to able the video call inside the office, but when the call is PSTN override this message to the switch of AT&T. Thanks in advance.

Cesar Adrian Garza Ruiz · ‎12-22-2010

After I opened a SR with TAC I have to upgrade to SR5 in order to fix a lot of problems that the TAC said it fixed with the SR. And in fact torough the Cisco Database Administration in the Server I removed the other servername and put as Default the actual servername, I restarted and everything work very well. So the workaround was the upgrade to the last SR, and the learning lesson is after you upgrade for any version of IPCC to the version 7.x you must upgrade to the last SR. Cesar

Cesar Adrian Garza Ruiz · ‎11-18-2010

Hi, I have an issue after upgraded the UCCX 4.X to 7.0 using the DMT, my customer tried to get the recordings of the calls from the agents, but when run the record viewer in the supervisor client got a message error "Following server is unavailable: IPCCSRV01 (Partial Service) Some Recordings will not available" but I checked the logs and the name of the server IPCCSRV01 is not the actual name of the UCCX server, that is IPCCSRV2010 by mistake my client got me another name of server, altough all the services, teams, scripts, workflows are working normally, the only issue I found are the recordings. For more information the logs are attached. I tried to find the register to indicate that the recording server is IPCCSRV2010 and not the other one. Thanks in advance Cesar

Cesar Adrian Garza Ruiz · ‎11-17-2010

Hi Michael, Another big 5 star thanks!, yes the way the domain change was modify the FQDN parameter, I assumed that the change in the proxy domain change automatically the FQDN, altough the federation is not work here. Thanks, Cesar G.

Cesar Adrian Garza Ruiz · ‎11-16-2010

Hi, I tried to set a connectivity between 2 CUPS but the system troubleshooter mark Invalid inter-cluster proxy domains , this is the scenario; both CUPS are in the same domain (in theory), my customer have 2 head quarters, in each office have a CUCM with CUPS and the users in both office can communicate each other, but I have 2 question at this point; 1. This could be a Inter-Domain Federation, (this is because one of the CUPS have no domain configured, I did not configure this server in office 1) 2. This is inter-cluster, if this is the way; I have few problems to do this because for any reason (I did not configure the CUPS in office 1) there is no domain specified in the configuration, as the troubleshooter say is not the same domain, I tried to change in System>ServiceParameters>server>Sip Proxy>Proxy domain, right now is set to PROXY_DOMAIN_NOT_SET, after I did the change and restart the Presence Engine, this parameter still the same. Then I went to CLI and checked the domain value, and have no domain configured, I configure the DNS and then set the domain, but I can not change the sip proxy domain value in the administration interface. Any advice to force this parameter change. If need more information I'll be pleased to share. Tks in advance Scenario; Office 1 CUCM 7.1.3 CUPS 7.0.7 AD Microsoft (redundant with AD office 2) before: no domain set in the network, after: set network domain DOMAIN.COM Office 2 CUCM 7.1.5 CUPS 7.0.8 AD Microsoft (redundant with AD Office 1) Domain: DOMAIN.COM

Cesar Adrian Garza Ruiz · ‎07-14-2010

Hi Marcin, yes but theres something strange, because the configs are almost the same, the way that I have to force to work is, I erase all the configuration and re-enter, and automatically work, before I did this I force to activate the tunnel and I was working through the vpn, and the vpn client was working too, and the other VPN to Brasil too. But when I tested as if the DSL is down, the trouble comes again, because the Vpn seems to ask the XAUTH, I put the XAUTH line and work, but the vpn client didnt, I quit the xauth and the vpn client starts works. I mean the only way that the vpn set up automatically was if I erased all the config and put it again. But the VPN tunnel is working in the way that the traffic is passing through. Cesar

Cesar Adrian Garza Ruiz · ‎07-12-2010

Oh Man !!! I sure I probe with the exec line... but you both right... thanks !!!

Cesar Adrian Garza Ruiz · ‎07-09-2010

Hi all, I have a very strange issue here, after I read a lot of posting about the telnet problem no one resolving mine, actually I have everything configurated, well is not much, but I do not have any access list, no firewall between, only nat and I do not think this was the problem, the thing is that after telnet the IP I receive an Open, but almost instantly close the session, in the case of the SSH I receive the prompt for the password, but when I introduce the correct password the ssh session close. I do not receive any message, just that the foreing host closed. Remote Router: INTERNET_TMX#telnet 9.2.8.1 Trying 9.2.8.1 ... Open [Connection to 9.2.8.1 closed by foreign host] INTERNET_TMX#ss INTERNET_TMX#ssh -l cisco 9.2.8.1 Password: [Connection to 9.2.8.1 closed by foreign host] Config; ip nat inside source route-map nonat interface Dialer1 overload ! ip access-list extended lan2lan permit ip 192.168.225.0 0.0.0.255 192.168.0.0 0.0.255.255 permit ip 192.168.226.0 0.0.0.255 192.168.0.0 0.0.255.255 ip access-list extended nat deny ip 192.168.225.0 0.0.0.255 192.168.0.0 0.0.255.255 deny ip 192.168.226.0 0.0.0.255 192.168.0.0 0.0.255.255 permit ip 192.168.225.0 0.0.0.255 any permit ip 192.168.226.0 0.0.0.255 any ! route-map nonat permit 1 match ip address nat ! line con 0 logging synchronous login local no modem enable line aux 0 line 2 no activation-character no exec transport preferred none transport input all transport output pad telnet rlogin lapb-ta mop udptn v120 ssh line vty 0 4 login local no exec transport input telnet ssh ! end Debug: GW_MONMORELOS#debug telnet *Jul 9 22:53:13.974: Telnet67: 1 1 251 1 *Jul 9 22:53:13.974: TCP67: Telnet sent WILL ECHO (1) *Jul 9 22:53:13.974: Telnet67: 2 2 251 3 *Jul 9 22:53:13.974: TCP67: Telnet sent WILL SUPPRESS-GA (3) *Jul 9 22:53:13.974: Telnet67: 80000 80000 253 24 *Jul 9 22:53:13.974: TCP67: Telnet sent DO TTY-TYPE (24) *Jul 9 22:53:13.974: Telnet67: 10000000 10000000 253 31 *Jul 9 22:53:13.974: TCP67: Telnet sent DO WINDOW-SIZE (31) GW_MONMORELOS#debug ip ssh Incoming SSH debugging is on GW_MONMORELOS# GW_MONMORELOS# GW_MONMORELOS# *Jul 9 22:55:02.254: SSH0: starting SSH control process *Jul 9 22:55:02.254: SSH0: sent protocol version id SSH-2.0-Cisco-1.25 *Jul 9 22:55:02.270: SSH0: protocol version id is - SSH-1.99-Cisco-1.25 *Jul 9 22:55:02.270: SSH2 0: send:packet of length 344 (length also includes padlen of 5) *Jul 9 22:55:02.270: SSH2 0: SSH2_MSG_KEXINIT sent *Jul 9 22:55:02.274: SSH2 0: ssh_receive: 344 bytes received *Jul 9 22:55:02.274: SSH2 0: input: total packet length of 344 bytes *Jul 9 22:55:02.274: SSH2 0: partial packet length(block size)8 bytes,needed 336 bytes, maclen 0 *Jul 9 22:55:02.274: SSH2 0: input: padlength 5 bytes *Jul 9 22:55:02.274: SSH2 0: SSH2_MSG_KEXINIT received *Jul 9 22:55:02.274: SSH2:kex: client->server enc:aes128-cbc mac:hmac-sha1 *Jul 9 22:55:02.274: SSH2:kex: server->client enc:aes128-cbc mac:hmac-sha1 *Jul 9 22:55:02.294: SSH2 0: ssh_receive: 24 bytes received *Jul 9 22:55:02.294: SSH2 0: input: total packet length of 24 b GW_MONMORELOS#ytes *Jul 9 22:55:02.294: SSH2 0: partial packet length(block size)8 bytes,needed 16 bytes, maclen 0 *Jul 9 22:55:02.294: SSH2 0: input: padlength 6 bytes *Jul 9 22:55:02.294: SSH2 0: SSH2_MSG_KEX_DH_GEX_REQUEST received *Jul 9 22:55:02.294: SSH2 0: Range sent by client is - 1024 < 2048 < 4096 *Jul 9 22:55:02.294: SSH2 0: Modulus size established : 2048 bits *Jul 9 22:55:02.294: SSH2 0: send:packet of length 280 (length also includes padlen of 8) *Jul 9 22:55:02.350: SSH2 0: expecting SSH2_MSG_KEX_DH_GEX_INIT *Jul 9 22:55:02.486: SSH2 0: ssh_receive: 272 bytes received *Jul 9 22:55:02.486: SSH2 0: input: total packet length of 272 bytes *Jul 9 22:55:02.486: SSH2 0: partial packet length(block size)8 bytes,needed 264 bytes, maclen 0 *Jul 9 22:55:02.486: SSH2 0: input: padlength 5 bytes *Jul 9 22:55:02.486: SSH2 0: SSH2_MSG_KEXDH_INIT received *Jul 9 22:55:02.598: SSH2 0: signature length 143 *Jul 9 22:55:02.598: SSH2 0: send:packet of length 576 (length also includes padlen of 7) *Jul 9 22:55:02.602: SSH2: kex_derive_keys complete *Jul 9 22:55:02.602: SSH2 0: send:packet of length 16 (length also includes padlen of 10) *Jul 9 22:55:02.602: SSH2 0: newkeys: mode 1 *Jul 9 22:55:02.602: SSH2 0: SSH2_MSG_NEWKEYS sent *Jul 9 22:55:02.602: SSH2 0: waiting for SSH2_MSG_NEWKEYS *Jul 9 22:55:02.858: SSH2 0: ssh_receive: 16 bytes received *Jul 9 22:55:02.858: SSH2 0: input: total packet length of 16 bytes *Jul 9 22:55:02.858: SSH2 0: partial packet length(block size)8 bytes,needed 8 bytes, maclen 0 *Jul 9 22:55:02.858: SSH2 0: input: padlength 10 bytes *Jul 9 22:55:02.858: SSH2 0: newkeys: mode 0 *Jul 9 22:55:02.858: SSH2 0: SSH2_MSG_NEWKEYS received *Jul 9 22:55:02.858: SSH2 0: ssh_receive: 52 bytes received *Jul 9 22:55:02.858: SSH2 0: input: total packet length of 32 bytes *Jul 9 22:55:02.858: SSH2 0: partial packet length(block size)16 bytes,needed 16 bytes, maclen 20 *Jul 9 22:55:02.858: SSH2 0: MAC compared for #4 :ok *Jul 9 22:55:02.858: SSH2 0: input: padlength 10 bytes *Jul 9 22:55:02.858: SSH2 0: send:packet of length 32 (length also includes padlen of 10) *Jul 9 22:55:02.858: SSH2 0: computed MAC for sequence no.#4 *Jul 9 22:55:02.874: SSH2 0: ssh_receive: 84 bytes received *Jul 9 22:55:02.874: SSH2 0: input: total packet length of 64 bytes *Jul 9 22:55:02.874: SSH2 0: partial packet length(block size)16 bytes,needed 48 bytes, maclen 20 *Jul 9 22:55:02.874: SSH2 0: MAC compared for #5 :ok *Jul 9 22:55:02.874: SSH2 0: input: padlength 19 bytes *Jul 9 22:55:02.874: SSH2 0: send:packet of length 48 (length also includes padlen of 8) *Jul 9 22:55:02.874: SSH2 0: computed MAC for sequence no.#5 *Jul 9 22:55:02.890: SSH2 0: ssh_receive: 116 bytes received *Jul 9 22:55:02.890: SSH2 0: input: total packet length of 96 bytes *Jul 9 22:55:02.894: SSH2 0: partial packet length(block size)16 bytes,needed 80 bytes, maclen 20 *Jul 9 22:55:02.894: SSH2 0: MAC compared for #6 :ok *Jul 9 22:55:02.894: SSH2 0: input: padlength 16 bytes *Jul 9 22:55:02.894: SSH2 0: send:packet of length 48 (length also includes padlen of 11) *Jul 9 22:55:02.894: SSH2 0: computed MAC for sequence no.#6 *Jul 9 22:55:05.778: SSH2 0: ssh_receive: 52 bytes received *Jul 9 22:55:05.778: SSH2 0: input: total packet length of 32 bytes *Jul 9 22:55:05.778: SSH2 0: partial packet length(block size)16 bytes,needed 16 bytes, maclen 20 *Jul 9 22:55:05.778: SSH2 0: MAC compared for #7 :ok *Jul 9 22:55:05.778: SSH2 0: input: padlength 7 bytes *Jul 9 22:55:05.782: SSH2 0: send:packet of length 16 (length also includes padlen of 10) *Jul 9 22:55:05.782: SSH2 0: computed MAC for sequence no.#7 *Jul 9 22:55:05.786: SSH2 0: authentication successful for citrofrut *Jul 9 22:55:05.798: SSH2 0: ssh_receive: 68 bytes received *Jul 9 22:55:05.798: SSH2 0: input: total packet length of 48 bytes *Jul 9 22:55:05.798: SSH2 0: partial packet length(block size)16 bytes,needed 32 bytes, maclen 20 *Jul 9 22:55:05.802: SSH2 0: MAC compared for #8 :ok *Jul 9 22:55:05.802: SSH2 0: input: padlength 19 bytes *Jul 9 22:55:05.802: SSH2 0: channel open request *Jul 9 22:55:05.802: SSH2 0: send:packet of length 32 (length also includes padlen of 10) *Jul 9 22:55:05.802: SSH2 0: computed MAC for sequence no.#8 *Jul 9 22:55:05.818: SSH2 0: ssh_receive: 84 bytes received *Jul 9 22:55:05.818: SSH2 0: input: total packet length of 64 bytes *Jul 9 22:55:05.818: SSH2 0: partial packet length(block size)16 bytes,needed 48 bytes, maclen 20 *Jul 9 22:55:05.818: SSH2 0: MAC compared for #9 :ok *Jul 9 22:55:05.818: SSH2 0: input: padlength 13 bytes *Jul 9 22:55:05.818: SSH2 0: send:packet of length 16 (length also includes padlen of 6) *Jul 9 22:55:05.818: SSH2 0: computed MAC for sequence no.#9 *Jul 9 22:55:05.818: SSH2 0: pty-req request *Jul 9 22:55:05.818: SSH2 0: setting TTY - requested: height 47, width 132; set: height 47, width 132 *Jul 9 22:55:05.830: SSH2 0: ssh_receive: 52 bytes received *Jul 9 22:55:05.830: SSH2 0: input: total packet length of 32 bytes *Jul 9 22:55:05.834: SSH2 0: partial packet length(block size)16 bytes,needed 16 bytes, maclen 20 *Jul 9 22:55:05.834: SSH2 0: MAC compared for #10 :ok *Jul 9 22:55:05.834: SSH2 0: input: padlength 12 bytes *Jul 9 22:55:05.834: SSH2 0: send:packet of length 16 (length also includes padlen of 6) *Jul 9 22:55:05.834: SSH2 0: computed MAC for sequence no.#10 *Jul 9 22:55:05.834: SSH2 0: shell request *Jul 9 22:55:05.834: SSH2 0: shell message received *Jul 9 22:55:05.834: SSH2 0: starting shell for vty *Jul 9 22:55:05.934: SSH2 0: send:packet of length 48 (length also includes padlen of 18) *Jul 9 22:55:05.934: SSH2 0: computed MAC for sequence no.#11 *Jul 9 22:55:05.934: SSH2 0: send:packet of length 16 (length also includes padlen of 6) *Jul 9 22:55:05.934: SSH2 0: computed MAC for sequence no.#12 *Jul 9 22:55:05.934: SSH2 0: send:packet of length 16 (length also includes padlen of 6) *Jul 9 22:55:05.934: SSH2 0: computed MAC for sequence no.#13 *Jul 9 22:55:05.934: SSH0: Session terminated normally Any advice... Thanks, Cesar

Cesar Adrian Garza Ruiz · ‎07-09-2010

In the remote side: c1861-advipservicesk9-mz.124-22.T4.bin In the hub side: c2801-advsecurityk9-mz.124-20.T5.bin I just tried with a DMVPN configuration but none, I just get this; *********HUB*********** Nothing !°! *******SPOKE******* GW_MONMORELOS#ping 10.1.1.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds: *Jul 9 21:54:12.958: ISAKMP:(0): SA request profile is (NULL) *Jul 9 21:54:12.958: ISAKMP: Created a peer struct for 201.116.153.194, peer port 500 *Jul 9 21:54:12.958: ISAKMP: New peer created peer = 0x8825CA7C peer_handle = 0x800000FB *Jul 9 21:54:12.958: ISAKMP: Locking peer struct 0x8825CA7C, refcount 1 for isakmp_initiator *Jul 9 21:54:12.958: ISAKMP: local port 500, remote port 500 *Jul 9 21:54:12.958: ISAKMP: set new node 0 to QM_IDLE *Jul 9 21:54:12.958: ISAKMP:(0):insert sa successfully sa = 87B03520 *Jul 9 21:54:12.958: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. *Jul 9 21:54:12.958: ISAKMP:(0):found peer pre-shared key matching 201.116.153.194 *Jul 9 21:54:12.958: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID *Jul 9 21:54:12.958: ISAKMP:(0): constructed NAT-T vendor-07 ID *Jul 9 21:54:12.958: ISAKMP:(0): constructed NAT-T vendor-03 ID *Jul 9 21:54:12.958: ISAKMP:(0): constructed NAT-T vendor-02 ID *Jul 9 21:54:12.958: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM *Jul 9 21:54:12.958: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1 *Jul 9 21:54:12.958: ISAKMP:(0): beginning Main Mode exchange *Jul 9 21:54:12.958: ISAKMP:(0): sending packet to 201.116.153.194 my_port 500 peer_port 500 (I) MM_NO_STATE *Jul 9 21:54:12.958: ISAKMP:(0):Sending an IKE IPv4 Packet. *Jul 9 21:54:12.978: ISAKMP (0): received packet from 201.116.153.194 dport 500 sport 500 Global (I) MM_NO_STATE *Jul 9 21:54:12.978: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Jul 9 21:54:12.978: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM2 *Jul 9 21:54:12.978: ISAKMP:(0): processing SA payload. message ID = 0 *Jul 9 21:54:12.978: ISAKMP:(0): processing vendor id payload *Jul 9 21:54:12.978: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch *Jul 9 21:54:12.9.78: ISAKMP (0): vendor ID is NAT-T RFC 3947 *Jul 9 21:54:12.978: ISAKMP:(0):found peer pre-shared key matching 201.116.153.194 *Jul 9 21:54:12.978: ISAKMP:(0): local preshared key found *Jul 9 21:54:12.978: ISAKMP : Scanning profiles for xauth ... *Jul 9 21:54:12.978: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy *Jul 9 21:54:12.978: ISAKMP: encryption 3DES-CBC *Jul 9 21:54:12.978: ISAKMP: hash MD5 *Jul 9 21:54:12.978: ISAKMP: default group 2 *Jul 9 21:54:12.978: ISAKMP: auth pre-share *Jul 9 21:54:12.978: ISAKMP: life type in seconds *Jul 9 21:54:12.978: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80 *Jul 9 21:54:12.982: ISAKMP:(0):atts are acceptable. Next payload is 0 *Jul 9 21:54:12.982: ISAKMP:(0):Acceptable atts:actual life: 0 *Jul 9 21:54:12.982: ISAKMP:(0):Acceptable atts:life: 0 *Jul 9 21:54:12.982: ISAKMP:(0):Fill atts in sa vpi_length:4 *Jul 9 21:54:12.982: ISAKMP:(0):Fill atts in sa life_in_seconds:86400 *Jul 9 21:54:12.982: ISAKMP:(0):Returning Actual lifetime: 86400 *Jul 9 21:54:12.982: ISAKMP:(0)::Started lifetime timer: 86400. *Jul 9 21:54:12.982: ISAKMP:(0): processing vendor id payload *Jul 9 21:54:12.982: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch *Jul 9 21:54:12.982: ISAKMP (0): vendor ID is NAT-T RFC 3947 *Jul 9 21:54:12.982: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Jul 9 21:54:12.982: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM2 *Jul 9 21:54:12.982: ISAKMP:(0): sending packet to 201.116.153.194 my_port 500 peer_port 500 (I) MM_SA_SETUP *Jul 9 21:54:12.982: ISAKMP:(0):Sending an IKE IPv4 Packet. *Jul 9 21:54:12.982: ISAKMP:(0):Input = IKE_M.ESG_INTERNAL, IKE_PROCESS_COMPLETE *Jul 9 21:54:12.982: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM3 *Jul 9 21:54:13.074: ISAKMP (0): received packet from 201.116.153.194 dport 500 sport 500 Global (I) MM_SA_SETUP *Jul 9 21:54:13.074: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Jul 9 21:54:13.074: ISAKMP:(0):Old State = IKE_I_MM3 New State = IKE_I_MM4 *Jul 9 21:54:13.074: ISAKMP:(0): processing KE payload. message ID = 0 *Jul 9 21:54:13.098: ISAKMP:(0): processing NONCE payload. message ID = 0 *Jul 9 21:54:13.098: ISAKMP:(0):found peer pre-shared key matching 201.116.153.194 *Jul 9 21:54:13.098: ISAKMP:(2239): processing vendor id payload *Jul 9 21:54:13.098: ISAKMP:(2239): vendor ID is Unity *Jul 9 21:54:13.098: ISAKMP:(2239): processing vendor id payload *Jul 9 21:54:13.098: ISAKMP:(2239): vendor ID is DPD *Jul 9 21:54:13.098: ISAKMP:(2239): processing vendor id payload *Jul 9 21:54:13.098: ISAKMP:(2239): speaking to another IOS box! *Jul 9 21:54:13.098: ISAKMP:received payload type 20 *Jul 9 21:54:13.098: ISAKMP (2239): His hash no match - this node outside NAT *Jul 9 21:54:13.098: ISAKMP:received payload type 20 *Jul 9 21:54:13.098: ISAKMP (2239): No NAT Found for self or peer *Jul 9 21:54:13.098: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Jul 9 21:54:13.098: ISAKMP:(2239):Old State = IKE_I_MM4 New State = IKE_I_MM4 *Jul 9 21:54:13.098: ISAKMP:(2239):Send initial contact *Jul 9 21:54:13.098: ISAKMP:(2239):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR *Jul 9 21:54:13.098: ISAKMP (2239): ID payload next-payload : 8 type : 1 address : 189.152.38.131 protocol : 17 por.t : 500 length : 12 *Jul 9 21:54:13.098: ISAKMP:(2239):Total payload length: 12 *Jul 9 21:54:13.098: ISAKMP:(2239): sending packet to 201.116.153.194 my_port 500 peer_port 500 (I) MM_KEY_EXCH *Jul 9 21:54:13.098: ISAKMP:(2239):Sending an IKE IPv4 Packet. *Jul 9 21:54:13.102: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Jul 9 21:54:13.102: ISAKMP:(2239):Old State = IKE_I_MM4 New State = IKE_I_MM5 *Jul 9 21:54:13.118: ISAKMP (2239): received packet from 201.116.153.194 dport 500 sport 500 Global (I) MM_KEY_EXCH *Jul 9 21:54:13.118: ISAKMP:(2239): processing ID payload. message ID = 0 *Jul 9 21:54:13.118: ISAKMP (2239): ID payload next-payload : 8 type : 1 address : 201.116.153.194 protocol : 17 port : 500 length : 12 *Jul 9 21:54:13.122: ISAKMP:(0):: peer matches *none* of the profiles *Jul 9 21:54:13.122: ISAKMP:(2239): processing HASH payload. message ID = 0 *Jul 9 21:54:13.122: ISAKMP:(2239):SA authentication status: authenticated *Jul 9 21:54:13.122: ISAKMP:(2239):SA has been authenticated with 201.116.153.194 *Jul 9 21:54:13.122: ISAKMP: Trying to insert a peer 189.152.38.131/201.116.153.194/500/, and inserted successfully 8825CA7C. *Jul 9 21:54:13.122: ISAKMP:(2239):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Jul 9 21:54:13.122: ISAKMP:(2239):Old State = IKE_I_MM5 New State = IKE_I_MM6 *Jul 9 21:54:13.122: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE *Jul 9 21:54:13.122: ISAKMP:(2239):Old State = IKE_I_MM6 New State = IKE_I_MM6 *Jul 9 21:54:13.122: ISAKMP (2239): received packet from 201.116.153.194 dport 500 sport 500 Global (I) MM_KEY_EXCH *Jul 9 21:54:13.122:. ISAKMP: set new node 781795278 to QM_IDLE *Jul 9 21:54:13.122: ISAKMP:(2239):processing transaction payload from 201.116.153.194. message ID = 781795278 *Jul 9 21:54:13.122: ISAKMP: Config payload REQUEST *Jul 9 21:54:13.122: ISAKMP (2239): Unknown Input IKE_MESG_FROM_PEER, IKE_CFG_REQUEST: state = IKE_I_MM6 *Jul 9 21:54:13.122: ISAKMP:(2239):Input = IKE_MESG_FROM_PEER, IKE_CFG_REQUEST *Jul 9 21:54:13.122: ISAKMP:(2239):Old State = IKE_I_MM6 New State = IKE_I_MM6 *Jul 9 21:54:13.122: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Jul 9 21:54:13.122: ISAKMP:(2239):Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE *Jul 9 21:54:13.122: ISAKMP:(2239):beginning Quick Mode exchange, M-ID of -1234842268 *Jul 9 21:54:13.126: ISAKMP:(2239):QM Initiator gets spi *Jul 9 21:54:13.126: ISAKMP:(2239): sending packet to 201.116.153.194 my_port 500 peer_port 500 (I) QM_IDLE *Jul 9 21:54:13.126: ISAKMP:(2239):Sending an IKE IPv4 Packet. *Jul 9 21:54:13.126: ISAKMP:(2239):Node -1234842268, Input = IKE_MESG_INTERNAL, IKE_INIT_QM *Jul 9 21:54:13.126: ISAKMP:(2239):Old State = IKE_QM_READY New State = IKE_QM_I_QM1 *Jul 9 21:54:13.126: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE *Jul 9 21:54:13.126: ISAKMP:(2239):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE . Success rate is 0 percent (0/5) GW_MONMORELOS# *Jul 9 21:54:23.126: ISAKMP:(2239): retransmitting phase 2 QM_IDLE -1234842268 ... *Jul 9 21:54:23.126: ISAKMP (2239): incrementing error counter on node, attempt 1 of 5: retransmit phase 2 *Jul 9 21:54:23.126: ISAKMP (2239): incrementing error counter on sa, attempt 1 of 5: retransmit phase 2 *Jul 9 21:54:23.126: ISAKMP:(2239): retransmitting phase 2 -1234842268 QM_IDLE *Jul 9 21:54:23.126: ISAKMP:(2239): sending packet to 201.116.153.194 my_port 500 peer_port 500 (I) QM_IDLE *Jul 9 21:54:23.126: ISAKMP:(2239):Sending an IKE IPv4 Packet. GW_MONMORELOS# GW_MONMORELOS# GW_MONMORELOS# GW_MONMORELOS# *Jul 9 21:54:28.118: ISAKMP (2239): received packet from 201.116.153.194 dport 500 sport 500 Global (I) QM_IDLE *Jul 9 21:54:28.118: ISAKMP:(2239):processing transaction payload from 201.116.153.194. message ID = 781795278 *Jul 9 21:54:28.118: ISAKMP: Config payload REQUEST *Jul 9 21:54:28.118: ISAKMP:(2239): No provision for the request *Jul 9 21:54:28.118: ISAKMP: Invalid config REQUEST *Jul 9 21:54:28.118: ISAKMP (2239): FSM action returned error: 2 *Jul 9 21:54:28.118: ISAKMP:(2239):Input = IKE_MESG_FROM_PEER, IKE_CFG_REQUEST *Jul 9 21:54:28.118: ISAKMP:(2239):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Jul 9 21:54:28.118: ISAKMP:(2239):peer does not do paranoid keepalives. *Jul 9 21:54:28.118: ISAKMP:(2239):deleting SA reason "IKMP_ERR_NO_RETRANS" state (I) QM_IDLE (peer 201.116.153.194) *Jul 9 21:54:28.118: ISAKMP: set new node -1734963281 to QM_IDLE *Jul 9 21:54:28.118: ISAKMP:(2239): sending packet to 201.116.153.19 GW_MONMORELOS#4 my_port 500 peer_port 500 (I) QM_IDLE *Jul 9 21:54:28.118: ISAKMP:(2239):Sending an IKE IPv4 Packet. *Jul 9 21:54:28.118: ISAKMP:(2239):purging node -1734963281 *Jul 9 21:54:28.118: ISAKMP:(2239):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL *Jul 9 21:54:28.118: ISAKMP:(2239):Old State = IKE_P1_COMPLETE New State = IKE_DEST_SA *Jul 9 21:54:28.122: ISAKMP:(2239):deleting SA reason "IKMP_ERR_NO_RETRANS" state (I) QM_IDLE (peer 201.116.153.194) *Jul 9 21:54:28.122: ISAKMP:(0):Can't decrement IKE Call Admission Control stat outgoing_active since it's already 0. *Jul 9 21:54:28.122: ISAKMP: Unlocking peer struct 0x8825CA7C for isadb_mark_sa_deleted(), count 0 *Jul 9 21:54:28.122: ISAKMP: Deleting peer node by peer_reap for 201.116.153.194: 8825CA7C *Jul 9 21:54:28.122: ISAKMP:(2239):deleting node -1234842268 error FALSE reason "IKE deleted" *Jul 9 21:54:28.122: ISAKMP:(2239):deleting node 781795278 error FALSE reason "IKE deleted" *Jul 9 21:54:28.122: ISAKMP:(2239):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Jul 9 21:54:28.122: ISAKMP:(2239):Old State = IKE_DEST_SA New State = IKE_DEST_SA Im lost ! Cesar

Cesar Adrian Garza Ruiz · ‎07-09-2010

Ok, this is the config that is working right now (but the vpn clients doesnt); In the other hand, actually I do not have any configuration for the other dynamic peer. I missing that?, (sorry, this is my first time that I have to configure a Vpn site to site, a vpn client, and a vpn site to site with dynamic IPs besides each other). *********************************HQ************************************ crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key ABC address 18.9.5.4 no-xauth crypto isakmp key abc address 0.0.0.0 0.0.0.0 no-xauth ! crypto isakmp client configuration group VPN-CLIENT key abc dns 192.168.210.10 192.168.210.20 pool mypool acl 110 ! crypto isakmp client configuration group VPNJF key abc dns 192.168.210.10 192.168.210.20 pool mypool acl 110 ! ! crypto ipsec transform-set myset esp-3des esp-sha-hmac ! crypto dynamic-map dynmap 10 set transform-set myset ! ! ! crypto map mymap client authentication list userauthen crypto map mymap isakmp authorization list groupauthor crypto map mymap client configuration address respond crypto map mymap 5 ipsec-isakmp set peer 18.2.5.14 set transform-set myset match address 120 crypto map mymap 10 ipsec-isakmp dynamic dynmap *For this config I do not put any match address because are learning from the other side. ----------------------------This do not work-------------------------------- ********** HQ ********* crypto keyring spokes pre-shared-key address 0.0.0.0 0.0.0.0 key abc ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key ABC address 7.2.4.4 no-xauth ! crypto isakmp client configuration group VPN-CLIENT key abc dns 192.168.210.10 192.168.210.20 pool mypool acl 110 ! crypto isakmp client configuration group VPNJF key xyz dns 192.168.210.10 192.168.210.20 pool mypool acl 110 crypto isakmp profile L2L keyring spokes match identity address 0.0.0.0 ! ! crypto ipsec transform-set myset esp-3des esp-sha-hmac ! crypto dynamic-map dynmap 5 set transform-set myset set isakmp-profile L2L match address mtmorelos crypto dynamic-map dynmap 10 set transform-set myset ! ip access-list extended mtmorelos permit ip 192.168.0.0 0.0.255.255 192.168.225.0 0.0.0.255 permit ip 192.168.0.0 0.0.255.255 192.168.226.0 0.0.0.255 ******************************Remote Side******************************* *The same config in both cases. ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key Citro2008 address 1.6.3.4 no-xauth ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac ! crypto map lan2lan 1 ipsec-isakmp description ## Hacia Citro Corp ## set peer 1.6.3.4 set transform-set ESP-3DES-SHA match address lan2lan ! ip access-list extended lan2lan permit ip 192.168.225.0 0.0.0.255 192.168.0.0 0.0.255.255 permit ip 192.168.226.0 0.0.0.255 192.168.0.0 0.0.255.255 ! Cesar El mensaje fue editado por: Cesar Garza

Cesar Adrian Garza Ruiz · ‎07-09-2010

Hi Marcin, Before thanks for answer, unfortunately after the changes that you suggest I do not see any change, but the good news is when I remove all the configuration about the profile, the keyring and the crypto 5, and only put the line "crypto isakmp key abc address 0.0.0.0 0.0.0.0 no-xauth" is working, yesterday it was not work in that way I dont know if all the other config was making some trouble, but the bad thing is that the VPN Clients stills outs, now my cuestion is, is there any way to make that both configs work together?. Config in HQ ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key notnow address 187.92.54.114 no-xauth crypto isakmp key crazyvpn address 0.0.0.0 0.0.0.0 no-xauth ! crypto isakmp client configuration group VPN-CLIENT key Avayawork dns 192.168.210.10 192.168.210.20 pool mypool acl 110 ! crypto isakmp client configuration group VPNJF key sunwork dns 192.168.210.10 192.168.210.20 pool mypool acl 110 ! ! crypto ipsec transform-set myset esp-3des esp-sha-hmac ! crypto dynamic-map dynmap 10 set transform-set myset ! ! ! crypto map mymap client authentication list userauthen crypto map mymap isakmp authorization list groupauthor crypto map mymap client configuration address respond crypto map mymap 5 ipsec-isakmp set peer 1x7.y2.z4.w14 set transform-set myset match address 120 crypto map mymap 10 ipsec-isakmp dynamic dynmap ! INTERNET_TMX#SH CRYpto SESsion Crypto session current status Interface: FastEthernet0/0 Session status: UP-ACTIVE Peer: 1X7.Y2.Z4.W14 port 500 IKE SA: local X01.Y16.Z53.W94/500 remote X87.Y2.Z4.W14/500 Active IPSEC FLOW: permit ip 192.168.208.0/255.255.240.0 192.168.240.0/255.255.252.0 Active SAs: 0, origin: crypto map IPSEC FLOW: permit ip 192.168.224.0/255.255.240.0 192.168.240.0/255.255.252.0 Active SAs: 2, origin: crypto map IPSEC FLOW: permit ip 192.168.32.0/255.255.247.0 192.168.240.0/255.255.252.0 Active SAs: 0, origin: crypto map Interface: FastEthernet0/0 Session status: UP-ACTIVE <------------------- is this one ! Peer: X89.Y52.Z8.W31 port 500 IKE SA: local X01.Y16.Z53.W94/500 remote S89.Y52.Z8.W31/500 Active IPSEC FLOW: permit ip 192.168.0.0/255.255.0.0 192.168.225.0/255.255.255.0 Active SAs: 2, origin: dynamic crypto map IPSEC FLOW: permit ip 192.168.0.0/255.255.0.0 192.168.226.0/255.255.255.0 Active SAs: 2, origin: dynamic crypto map any idea??? Cesar

Cesar Adrian Garza Ruiz · ‎07-09-2010

Yes, but I did the configuration of the line "crypto isakmp key abc address 0.0.0.0 0.0.0.0 no-xauth" but this cause conflict with the connection of the user of the VPN Client, until I quit the line the VPN client is connected as always, I do not find any other form to keep the no-xauth, this is a peer with no fixed IP. I get this error in the debug when I tried to connect the VPN Client: *Jul 9 17:17:54.674: ISAKMP : Scanning profiles for xauth ... *Jul 9 17:17:54.674: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy *Jul 9 17:17:54.674: ISAKMP: encryption AES-CBC *Jul 9 17:17:54.674: ISAKMP: hash SHA *Jul 9 17:17:54.674: ISAKMP: default group 2 *Jul 9 17:17:54.674: ISAKMP: auth XAUTHInitPreShared *Jul 9 17:17:54.674: ISAKMP: life type in seconds *Jul 9 17:17:54.674: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B *Jul 9 17:17:54.674: ISAKMP: keylength of 256 *Jul 9 17:17:54.674: ISAKMP:(0):Encryption algorithm offered does not match policy! *Jul 9 17:17:54.674: ISAKMP:(0):atts are not acceptable. Next payload is 3 . . . . *Jul 9 17:17:54.674: ISAKMP : Scanning profiles for xauth ... *Jul 9 17:17:54.674: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy *Jul 9 17:17:54.674: ISAKMP: encryption AES-CBC *Jul 9 17:17:54.674: ISAKMP: hash SHA *Jul 9 17:17:54.674: ISAKMP: default group 2 *Jul 9 17:17:54.674: ISAKMP: auth XAUTHInitPreShared *Jul 9 17:17:54.674: ISAKMP: life type in seconds *Jul 9 17:17:54.674: ISAKMP: life duration (VPI) of 0x0 0x20 0xC4 0x9B *Jul 9 17:17:54.674: ISAKMP: keylength of 256 *Jul 9 17:17:54.674: ISAKMP:(0):Encryption algorithm offered does not match policy! *Jul 9 17:17:54.674: ISAKMP:(0):atts are not acceptable. Next payload is 3 *Jul 9 17:17:54.686: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) AG_NO_STATE (peer x01.y55.z30.w45)

Cesar Adrian Garza Ruiz · ‎07-09-2010

Hi everyone, I Have two sites in HQ I have a C2801 as Hub, and in the remote side I have a C1861 as spoke that is getting the Ip through an ADSL , after I configured both rtrs, all Steps in Phase1 are complete, at the next Phase, I get the error IKMP_ERR_NO_RETRANS, I read a lot of entries here, but none is like the one I have. Please can check if I missed some in the configuration. Another thing is that in the same C2801 I got a VPN Client and another vpn site to site, with fixed IP address and work perfect. Network in Remote Side: 192.168.225.0/24 and 192.168.226.0/24 Networks in HQ: 192.168.0.0 I attached the configs and debugs.

Date Registered	‎09-03-2008 03:17 PM
Date Last Visited	‎10-24-2017 01:14 PM
Total Messages Posted	22
Total Helpful Votes Received	19

Hi, I have the same issue, I

Hi Everyone, I have the same

IP PHONE 8941 ISSUE TO CALL PSTN-AT&T

Re: UCCX Supervisor Record Viewer Error

UCCX Supervisor Record Viewer Error

Re: CUPS Inter-cluster Deployment

CUPS Inter-cluster Deployment

Re: Vpn site-to-site phase2 fail

Re: Telnet SSH not working Strange

Telnet SSH not working Strange

Re: Vpn site-to-site phase2 fail

Re: Vpn site-to-site phase2 fail

Re: Vpn site-to-site phase2 fail

Re: Vpn site-to-site phase2 fail

Vpn site-to-site phase2 fail